ldap + kerberos 整合
第一部分：ldap
1. 安装ldap
2. 配置ldap
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/kerberos.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
loglevel 135
idletimeout 5
writetimeout 5
access to attrs=userPassword
by self read
by dn.exact="cn=ops,ou=Control,dc=lishen,dc=com" write
by anonymous auth
access to dn.subtree="cn=Kerberos,dc=lishen,dc=com"
by dn.exact="cn=kdc-adm,ou=Control,dc=lishen,dc=com" write
by dn.exact="cn=kdc-srv,ou=Control,dc=lishen,dc=com" read
by * none
access to dn.base=""
by * read
access to *
by self write
by dn.base="cn=ops,ou=Control,dc=lishen,dc=com" write
by users read
by anonymous read
#TLSCipherSuite HIGH:MEDIUM:-SSLv2
#TLSVerifyClient never
TLSCertificateFile /etc/openldap/certs/server.pem
TLSCertificateKeyFile /etc/openldap/certs/server.pem
TLSCACertificateFile /etc/openldap/certs/server.pem
#######################################################################
# BDB database definitions
#######################################################################
database hdb
suffix "dc=lishen,dc=com"
checkpoint 32 30
rootdn "cn=root,ou=Control,dc=lishen,dc=com"
rootpw {SSHA}ifM5X6pQS2eO8hODguTPmjRLFyCnVWvP
directory /var/lib/ldap/
dbconfig set_cachesize 0 268435456 1
dbconfig set_lg_regionmax 262144
dbconfig set_lg_bsize 2097152
index objectClass,entryCSN,entryUUID eq
index uid,uidNumber,gidNumber eq,pres
index ou,krbPrincipalName eq,pres,sub
说明：
1. rootpw 后面的密码是由命令 slappasswd -s 123456 生成
2. 证书使用命令生成：openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 36500
3. 启动openldap服务：slapd
4. 测试：现在数据库是空的
ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'
5. 初始化数据库
准备ldif文件：
cat init.ldif
dn: dc=lishen,dc=com
dc: lishen
objectClass: domain
objectClass: dcObject
dn: ou=Group,dc=lishen,dc=com
ou: Group
objectClass: organizationalUnit
dn: ou=Aliases,dc=lishen,dc=com
ou: Aliases
objectClass: organizationalUnit
dn: ou=People,dc=lishen,dc=com
ou: People
objectClass: organizationalUnit
dn: cn=Kerberos,dc=lishen,dc=com
cn: Kerberos
objectClass: organizationalRole
dn: ou=Control,dc=lishen,dc=com
ou: Control
objectClass: organizationalUnit
dn: cn=kdc-srv,ou=Control,dc=lishen,dc=com
cn: kdc-srv
userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
objectClass: simpleSecurityObject
objectClass: organizationalRole
dn: cn=kdc-adm,ou=Control,dc=lishen,dc=com
cn: kdc-adm
userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
objectClass: simpleSecurityObject
objectClass: organizationalRole
dn: cn=root,ou=Control,dc=lishen,dc=com
cn: root
userPassword:: e1NTSEF9cUNhclpCYXN1SWhGRExkQ1o4bUxTbkMyZXg3bXQ2UTMK
objectClass: simpleSecurityObject
objectClass: organizationalRole
dn: cn=demo_users,ou=Group,dc=lishen,dc=com
cn: demo_users
gidNumber: 20000
objectClass: posixGroup
dn: uid=test,ou=People,dc=lishen,dc=com
uid: test
uidNumber: 10000
gidNumber: 20000
sn: Test
cn: Test User
loginShell: /bin/bash
homeDirectory: /home/users/test
objectClass: person
objectClass: posixAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
说明：文件中的userPassword由命令slappasswd -s 123456 | base64生成
执行命令导入数据：ldapadd -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f init.ldif
执行命令验证数据导入是否成功： ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'
6. 去掉配置文件中配置的rootdn密码，因为ldif文件中已经配置了密码
注释掉slapd.conf文件中的rootpw {SSHA}J/6iFFDlPhucaupBEI9V//gkIFTZBNrr
重启slapd：service slapd restart
测试是否密码正确：ldapsearch -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -b 'dc=lishen,dc=com'
7. 现在如果要使用LDAP作为用户认证，只需要给用户(uid=test)添加userPassword属性即可
准备ldif文件：
dn: uid=test,ou=People,dc=lishen,dc=com
changetype: modify
add: userPassword
userPassword:: e1NTSEF9Ym0rZXloV1ExalB1aWNEVU1BaHlNM0hZVHh3REIrWU4K
执行命令：ldapmodify -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f add.ldif
如果需要更改密码，ldif例子如下：
# cat /tmp/change.ldif
dn: cn=kdc-adm,ou=Control,dc=demo,dc=local
changetype: modify
replace: userPassword
userPassword: e1NTSEF9aGc5OGh0OGVlbiszaGk3OFhkRVlWc0MzNWJ2SWRCcG8K
dn: cn=kdc-srv,ou=Control,dc=demo,dc=local
changetype: modify
replace: userPassword
userPassword: e1NTSEF9aGc5OGh0OGVlbiszaGk3OFhkRVlWc0MzNWJ2SWRCcG8K
执行命令：ldapmodify -x -D 'cn=root,ou=Control,dc=lishen,dc=com' -w 123456 -h 127.0.0.1 -f change.ldif
第二部分：kerberos
1. 安装kerberos
2. 配置Kerberos
[libdefaults]
debug = false
default_realm = LISHEN.COM
[realms]
LISHEN.COM = {
kdc = 127.0.0.1
admin_server = 127.0.0.1
default_domain = lishen.com
database_module = openldap_ldapconf
key_stash_file = /etc/krb5.LISHEN.COM
max_life = 1d 0h 0m 0s
max_renewable_life = 90d 0h 0m 0s
dict_file = /usr/share/dict/words
}
[domain_realm]
.lishen.com = LISHEN.COM
lishen.com = LISHEN.COM
[logging]
default = SYSLOG
admin_server = FILE:/var/log/kadmind.log
kdc = FILE:/var/log/kdc.log
[dbdefaults]
ldap_kerberos_container_dn = cn=Kerberos,dc=lishen,dc=com
[dbmodules]
openldap_ldapconf = {
db_library = kldap
ldap_servers = ldapi://
ldap_kerberos_container_dn = cn=Kerberos,dc=lishen,dc=com
ldap_kdc_dn = cn=kdc-srv,ou=Control,dc=lishen,dc=com
ldap_kadmind_dn = cn=kdc-adm,ou=Control,dc=lishen,dc=com
ldap_service_password_file = /etc/krb5.ldap
ldap_conns_per_server = 5
}
说明： ldap_kerberos_container_dn must start with a 'cn'.
4. 生成访问ldap的服务密码文件
kdb5_ldap_util -D cn=root,ou=Control,dc=lishen,dc=com -w 123456 stashsrvpw -f /etc/krb5.ldap cn=kdc-adm,ou=Control,dc=lishen,dc=com
5. 创建kerberos数据库
6. 启动kerberos
#
7. 测试：添加用户
Authenticating as principal root/admin@LISHEN.COM with password.
kadmin.local: addprinc test
WARNING: no policy specified for test@LISHEN.COM; defaulting to no policy
Enter password for principal "test@LISHEN.COM":
Re-enter password for principal "test@LISHEN.COM":
Principal "test@LISHEN.COM" created.
#slapcat |grep "test"
dn: uid=test,ou=People,dc=lishen,dc=com
uid: test
homeDirectory: /home/users/test
dn: krbPrincipalName=test@LISHEN.COM,cn=LISHEN.COM,cn=Kerberos,dc=lishen,dc=co
krbPrincipalName: test@LISHEN.COM
添加用户成功
测试获取凭证：
Password for test@LISHEN.COM:
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: test@LISHEN.COM
Valid starting Expires Service principal
10/16/2016 02:11:55 10/17/2016 02:11:55 krbtgt/LISHEN.COM@LISHEN.COM
帮助：
1. http://blog.clanzx.net/2013/09/27/ldap-kerberos.html
2. http://web.mit.edu/KERBEROS/krb5-1.12/doc/admin/conf_ldap.html
3. http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/installSetup/settingUpOpenLDAPOnCentos6.htm
4. http://secfree.github.io/blog/2015/06/29/kerberos-ldap-deploy.html#kdc--kadmin--dn--acl
5. http://ian.wang/69.htm
6. https://help.ubuntu.com/lts/serverguide/kerberos-ldap.html#kerberos-ldap-openldap
ldap使用工具：http://directory.apache.org/studio/
